Privacy Policy — How cv998 Protects Your Data

This Privacy Policy ("Policy") describes how cv998 ("cv998", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("Player", "User", "you") who access or use the cv998 online casino and sports betting platform at cv998.io (the "Platform").

This Policy applies to all personal data collected through the following channels: the cv998 website and mobile browser interface; account registration and identity verification processes; deposit and withdrawal transactions via bKash, Nagad, Rocket, Upay, Visa, and Mastercard; customer support interactions via email; and any promotional or bonus-related communications.

By registering an account on cv998, you acknowledge that you have read this Policy in full and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must not register an account or use the Platform.

For the purposes of this Privacy Policy, cv998 acts as the data controller in respect of all personal data collected from players who access the Platform from Bangladesh. As data controller, cv998 determines the purposes and means by which personal data is processed.

All privacy-related enquiries, data access requests, data correction requests, and data deletion requests should be directed to the cv998 Data Privacy team at the contact details provided in Section 15 of this Policy.

Where cv998 engages third-party service providers to process personal data on its behalf (for example, payment processors, game providers, or analytics services), those third parties act as data processors and are contractually bound to process data only on cv998's documented instructions and to maintain appropriate technical and organisational security measures.

cv998 collects personal data from you in the following ways:

Data you provide directly: When you register an account, you provide your full legal name, date of birth, residential address in Bangladesh (including city — Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, or others), email address, and a mobile number linked to your preferred mobile financial service. During KYC verification, you additionally provide a copy of your National Identity Card (NID), passport, or driving licence. When you contact customer support, you provide the content of your communications.

Data generated through your use of the Platform: As you use cv998, we automatically collect technical and usage data including your IP address, device identifiers, browser type and version, operating system, referral source, pages viewed, time spent on the Platform, games played (including slot titles, live casino tables, and cricket betting markets such as BPL, IPL, and T20 World Cup), and in-session behaviour patterns.

Data from payment providers: When you make a deposit or request a withdrawal, cv998 receives transaction confirmation data from bKash, Nagad, Rocket, Upay, Visa, or Mastercard. This includes transaction reference numbers, amounts in BDT, timestamps, and the partial identifier of your payment account (e.g., the last four digits of a card or a masked mobile number). cv998 does not receive or store your full card number, PIN, or mobile banking password.

Data from identity verification services: Where cv998 uses third-party identity verification services to confirm the authenticity of identity documents, those services may return verification status results, document authenticity scores, and match confidence levels to cv998. The underlying document images are processed by the verification provider under their own privacy terms.

cv998 uses your personal data for the following purposes:

• Account management: Creating and maintaining your cv998 account, authenticating your login sessions, and managing your account preferences and settings.
• Identity & age verification: Confirming that you are 21 years of age or older and that the identity details you provide are genuine and belong to you. This is a legal requirement for operating a gambling platform.
• Payment processing: Facilitating deposits and withdrawals in Bangladeshi Taka (BDT) via bKash, Nagad, Rocket, Upay, Visa, and Mastercard. Matching payment accounts to verified identity records to prevent third-party transactions.
• Fraud prevention & security: Detecting, investigating, and preventing fraudulent account activity, unauthorised access attempts, bonus abuse, money laundering, and other forms of financial crime. This includes automated pattern-detection systems that analyse transaction behaviour and session data.
• Responsible gaming: Monitoring for indicators of problem gambling behaviour (such as unusual deposit frequency, rapid loss patterns, or self-reported distress) and proactively applying responsible gaming tools where necessary. Delivering deposit limit alerts, session reminders, and cooling-off notifications.
• Customer support: Responding to enquiries, resolving complaints, processing KYC submissions, handling withdrawal requests, and maintaining records of customer interactions for quality assurance and dispute resolution.
• Platform improvement: Analysing aggregated usage data to improve the cv998 platform, optimise page loading speeds, identify and fix technical errors, and develop new features that better serve Bangladeshi players.
• Marketing communications: Sending promotional emails and notifications about bonuses, BPL cricket betting promotions, Eid special offers, and new game launches — but only where you have provided explicit consent to receive such communications. You may withdraw consent at any time by contacting support.
• Legal & regulatory compliance: Meeting obligations under applicable anti-money laundering, counter-terrorism financing, and data protection frameworks. Cooperating with lawful requests from law enforcement or regulatory bodies.

cv998 relies on the following legal bases when processing your personal data:

• Contract performance: Processing necessary to provide the services you have signed up for, including account creation, payment processing, game access, and withdrawal handling.
• Legal obligation: Processing required to comply with applicable laws and regulations, including age verification (21+), KYC identity checks, anti-money laundering record-keeping, and responding to lawful requests from authorities.
• Legitimate interests: Processing that serves cv998's genuine business interests where those interests are not overridden by your privacy rights, including fraud detection, platform security, technical analytics, and improving service quality.
• Consent: Processing based on your explicit opt-in, including non-essential cookies, marketing communications, and any processing of sensitive data categories. You may withdraw consent at any time without affecting the lawfulness of prior processing.

cv998 uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device that help the Platform remember your preferences, maintain your login session, and analyse how you interact with the site.

cv998 uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function correctly. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as language settings, notification preferences, and last-visited game category (e.g., slots, live casino, or cricket betting). These improve your user experience but are not essential.
• Analytics cookies: Collect aggregated, anonymised data about how players navigate the Platform, which pages are most visited, and where players encounter errors. cv998 uses this data to improve the platform experience for players in Dhaka, Chittagong, Sylhet, and across Bangladesh.
• Marketing cookies: Used only where you have given explicit consent. These may track your interaction with cv998 promotional content across sessions to help cv998 deliver more relevant offers. Third-party marketing cookies are not used.

You can control non-essential cookies through your browser settings. Disabling analytics and marketing cookies will not prevent you from using the cv998 platform.

cv998 does not sell your personal data. We share personal data with third parties only in the following limited circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive the minimum data necessary to process your transactions (account identifiers, amounts, and timestamps). Each payment provider operates under their own privacy policy and data security standards.
• Game providers: When you launch a game provided by a third-party studio (Evolution Gaming, Pragmatic Play, Spribe, Ezugi, NetEnt, Microgaming), your session data (including wager amounts and game results) may be shared with the provider for game integrity and technical support purposes. Game providers do not receive your full identity or payment data.
• Identity verification providers: Third-party KYC service providers receive copies of identity documents you submit during the verification process. These providers are bound by strict data processing agreements and may not use your data for any purpose other than identity verification on cv998's behalf.
• IT and infrastructure providers: Cloud hosting, database management, and cybersecurity service providers who process data on cv998's behalf under contractual data processing agreements.
• Legal and regulatory authorities: Where required by law or a valid legal process, cv998 may disclose personal data to law enforcement agencies, regulatory bodies, or courts. cv998 will notify affected players of such disclosures where legally permitted to do so.

Some of the third-party service providers used by cv998 (including game providers and cloud infrastructure providers) may store or process data outside of Bangladesh. Where personal data is transferred internationally, cv998 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Bangladesh.

Safeguards used for international transfers include contractual data processing agreements with standard contractual clauses, data transfer impact assessments where required, and selection of providers who maintain internationally recognised security certifications (such as ISO 27001).

Where you have questions about the specific countries to which your data may be transferred, you may contact cv998 at [email protected] to request further information.

cv998 retains personal data for as long as is necessary to fulfil the purposes described in this Policy, and to meet applicable legal, regulatory, and audit requirements. The following retention periods apply as general guidelines:

• Account and identity data: Retained for the lifetime of your account and for a minimum of five years following account closure, to meet anti-money laundering and KYC record-keeping obligations.
• Transaction and wagering records: Retained for a minimum of five years from the date of each transaction, in accordance with financial record-keeping requirements.
• Customer support records: Retained for three years from the date of the last interaction, unless the interaction relates to a formal complaint or legal matter, in which case the retention period follows the relevant legal limitation period.
• Marketing consent records: Retained for the duration of your marketing subscription plus three years thereafter, to demonstrate consent compliance.
• Technical and usage data (cookies, IP logs): Retained for up to 13 months from collection, after which they are anonymised or deleted.

When the applicable retention period expires, cv998 securely deletes or anonymises personal data so that it can no longer be associated with any individual. Data that has been anonymised and aggregated may be retained indefinitely for analytical and statistical purposes.

As a cv998 player in Bangladesh, you have the following rights in relation to your personal data. To exercise any of these rights, contact cv998 at [email protected] with "Privacy Rights Request" in the subject line. cv998 will respond within ten business days.

• Right of Access: You may request a copy of all personal data cv998 holds about you, including the categories of data, the purposes for which it is processed, and any third parties with whom it has been shared.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held about you. Minor corrections (e.g., updating your email address) can be made directly in your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you object to processing and there are no overriding legitimate grounds. This right is subject to legal retention obligations — cv998 cannot delete data it is legally required to retain.
• Right to Restriction of Processing: You may request that cv998 restrict the processing of your data in certain circumstances, for example while a data accuracy dispute is being investigated.
• Right to Data Portability: You may request that cv998 provide your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) to enable you to transfer it to another service provider.
• Right to Object: You may object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, in which case cv998 must cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

cv998 implements a comprehensive range of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, accidental loss, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and cv998 servers.
• AES-256 encryption for sensitive data stored at rest in cv998 databases, including identity documents and payment details.
• Password hashing using bcrypt with a high work factor, ensuring that even if database data were compromised, passwords would not be retrievable in plain text.
• Multi-factor authentication options for player accounts, with mandatory 2FA available for withdrawal requests above ৳10,000.
• Role-based access controls (RBAC) ensuring that cv998 staff can only access personal data necessary for their specific job function. No single employee has unrestricted access to all personal data.
• Regular third-party penetration testing and vulnerability assessments of the cv998 platform and infrastructure.
• Real-time intrusion detection systems (IDS) that monitor for abnormal access patterns and automatically trigger security alerts.
• Secure data centre facilities with physical access controls, 24/7 monitoring, and environmental protections.

Despite these measures, no internet-based platform can guarantee absolute security. You are also responsible for maintaining the security of your own account by using a strong, unique password and not sharing your login credentials with any third party.

If cv998 becomes aware that personal data from an individual under 21 has been collected — whether through a registration attempt, a reported incident, or a parental complaint — all associated data will be immediately deleted and the account will be permanently closed. Any funds deposited during the period of underage access will be returned to the source payment method after identity confirmation.

If you are a parent or guardian and believe that a minor in your care has accessed cv998 or provided personal data to the Platform, please contact cv998 immediately at [email protected] with the subject line "Minor Account — Urgent". cv998 will prioritise the investigation and resolution of all such reports.

cv998 processes certain personal data specifically for responsible gaming purposes. This includes monitoring wagering patterns, deposit frequency, session duration, and loss trajectories to identify players who may be showing signs of problem gambling.

Where responsible gaming indicators are detected, cv998 may proactively contact a player by email, apply account-level deposit limits, issue session break reminders, or in serious cases, initiate a cooling-off period. The processing of data for these purposes is based on cv998's legitimate interest in player welfare and its commitment to responsible gambling practices.

Responsible gaming data — including self-exclusion records, cooling-off requests, and deposit limit histories — is retained for a minimum of five years from the date of the relevant action, regardless of whether the account remains active. This retention period is necessary to ensure that self-exclusion commitments are honoured even if a player attempts to re-register.

For more information on responsible gaming tools available on cv998, please visit the /responsible-gaming page.

cv998 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, changes to the categories of data collected, the purposes for which data is used, or the third parties with whom data is shared — cv998 will provide at least fourteen calendar days' advance notice by email to your registered address and/or through a prominent notice on the Platform.

Minor amendments, such as corrections to typographical errors, clarifications that do not alter the substance of any data processing activity, or updates to reflect changes in applicable law, may take effect immediately without advance notice.

The effective date of the current version of this Privacy Policy is stated at the top of this document. Following the effective date, continued use of the Platform constitutes your acceptance of the updated Policy. If you do not accept the updated Policy, you should cease using the Platform and request account closure.

All previous versions of this Privacy Policy are archived and available upon request by emailing [email protected].

If you have any questions, concerns, or complaints regarding this Privacy Policy or the manner in which cv998 processes your personal data, please contact the cv998 Data Privacy team using the details below:

• Privacy Enquiries Email: [email protected] (plain text — not a clickable link)
• Subject Line for Privacy Requests: "Privacy Rights Request — [Your Registered Name]"
• Response Time: Within 10 business days for data access, rectification, and erasure requests.
• Languages: English
• Availability: 24 hours a day, 7 days a week including Bangladesh public holidays
• Time Zone: Bangladesh Standard Time (BST, UTC+6)

cv998 takes all privacy complaints seriously and will acknowledge receipt of your complaint within two business days, provide a substantive response within ten business days, and — where a complaint cannot be resolved internally — suggest independent mediation as an alternative resolution pathway.